Configuration File Options

This document describes the configuration options available for EasySMF Events.

Configuration File Format

The configuration is specified using a lenient JSON format. This is based on JSON, but also allows:

• comments using // or /* ... */
• names and strings may be unquoted or single quoted
• yes or no instead of true or false
• names and values can be separated by "=" instead of ":"

Every time the program starts it prints the active configuration, so you can copy it and use it as a basis for any modifications. The Splunk authorization token is masked in the output.

Specifying the Configuration

The --config command line option points to the configuration.

Use a configuration file

java -jar easysmf-events.jar --config myconfig.json ...

Use a DD name (JZOS Batch Launcher)

//EASYSMF  EXEC PGM=JVMLDM17,
// PARM='/ -jar easysmf-events.jar'
//MAINARGS DD DATA,DLM=$$
--config //DD:CONFIG
...
$$
//CONFIG DD  *
...

Use a dataset name

java -jar easysmf-events.jar --config //'MY.CONFIG.DATASET' ...

Notes

• Command line options override configuration file settings

Default configuration

The default configuration shows the format:

  "smf-in-memory-resource": "",
  "timezones": {
    "default": "America/Chicago",
    "EG01": "America/Los_Angeles",
    "EG02": "America/New_York"
  },
  "interval": 5,
  "splunk-url": "https://splunk.example.com:8088",
  "splunk-auth": "",
  "max-post": 1048576,
  "compress": "yes",
  "zos": "yes",
  "jobs": "yes",
  "datasets": "yes",
  "files": "yes",
  "rmf": "yes",
  "tcpip": "yes"

Configuration Options

Data Source

Option	Default	Description
smf-in-memory-resource	""	The name of the SMF In Memory Resource for real time processing

Output

Option	Default	Description
splunk-url	"https://splunk.example.com:8088"	Splunk HEC endpoint URL
splunk-auth	""	Splunk HEC authentication token. This can be read from a separate file using CREDENTIALS_DIRECTORY
compress	true	Enable compression for transmitted data
max-post	1048576	Maximum POST size to Splunk HEC in bytes (1MB)

Notes

• Testing suggests that the compress option saves CPU time - Java uses zEDC and it takes less CPU time to compress the data than to send the uncompressed data. Verify on your system if CPU usage is important.

• The HEC token can be located in a separate file with additional security protection and supplied the CREDENTIALS_DIRECTORY environment variable.

  See the Credentials Directory topic for more information.

Timezone Configuration

Option	Description
timezones	Timezone mappings for different systems

Many SMF fields are expressed in system local time. Splunk times are based on UTC. Times are translated to UTC before sending to Splunk.

When reading from the SMF Real Time Interface, EasySMF uses the system timezone (CVTLDTO). However, when reading historical data the current system timezone could be different to when the record was written.

The timezones option allows you to specify a default time zone and different time zones for different systems. The Java time zone rules are used to translate local date times to UTC time, including allowances for daylight savings changes.

See: LocalDateTime.atZone() for a description of the time zone rules.

timezones maps SMFIDs to Java timezone IDs:

"timezones": {
  "default": "America/Chicago",
  "EG01": "America/Los_Angeles",
  "EG02": "America/New_York"
}

Notes

• Timezone IDs must be valid Java ZoneId values

Processing Options

Option	Default	Description
interval	5	Reporting interval in minutes (between 1 and 60). EasySMF reports some statistics at regular intervals.

Security Options

Option	Default	Description
insecure	false	Ignore https certificate validation errors.

SMF Processing Options

Option	Default	Description
zos	true	Process z/OS system events
jobs	true	Process job accounting data
datasets	true	Process dataset activity data
files	true	Process unix file activity data
rmf	true	Process RMF performance data
tcpip	true	Process TCP/IP events